Gemstone-Source

Authenticated users with `api.webhooks.write` permission can create webhooks using unrestricted cURL protocols such as `file://`, `dict://`, or `gopher://`. This allows attackers to trigger webhook events to read local files, access process information, or pivot to internal services.

A regular expression denial of service (ReDoS) exists in the `regex replace` filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the `security.twig content.process enabled` variable, an authenticated page editor can provide a catastrophically backtracking PCRE pattern. This pattern is passed to the PHP `preg replace()` function, leading to unbounded CPU consumption and a denial of service for the web server process.

An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the `sanitizeHttpUrl()` function fails to verify the host against the server's own origin, checking only that the URL scheme is http or https. The issue exists in the 'POST /api/v1/auth/forgot-password' endpoint via the `admin base url` field, and can also be influenced by the `Referer` or `Origin` headers. If a victim follows the malicious link, the valid reset token is disclosed to the attacker, allowing for full account takeover.

An issue exists where the XSS blueprint validator `Security::detectXss()` processes raw page content before Twig processing occurs. If Twig content processing is enabled via `twig content.process enabled: true`, a user with page-write API permissions can bypass the validator using Twig's string concatenation operator (~) to dynamically create event handlers, dangerous tags, or protocols. Because the validator only sees the Twig expression and not the final rendered output, arbitrary JavaScript can be executed in the browsers of visitors when the content is rendered via `{{ page.content|raw }}`.